CBA data breach: The law is the law but does transparency matter more?

Last week it was revealed by news services, and later confirmed, that the Commonwealth Bank (CBA) had reported a data breach to the regulators in 2016. But the real story was that the bank had not reported the incident any further than this at the relevant time and in particular had not informed its customers to which the data related.

CBA has admitted that in 2016, it did not receive the required evidence of destruction of two magnetic tapes that were supposed to be destroyed by its subcontractor Fuji-Xerox. The tapes contained partial information that enabled statements to be printed, such as customers' names, addresses, account numbers and transaction details from 2000 – 2016. Reportedly, almost 20 million customer accounts were affected, but the bank was quick to stress the information did not contain details that would enable someone to access an account such as passwords or PINS. When CBA did not receive certificates of destruction, it launched an